Author Topic: Fake Proxy Host_Name & IP Filters!  (Read 19828 times)

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #15 on: May 26, 2002, 07:17:53 AM »
Hi "GUYS",
         The "Client-IP Filter" has an interesting side-effect. It seems to make the test-pages think that there are TWO (Type1) Proxy Servers being used for the Connection. Now ALL the Info that You See below is Not REAL, all except the "Reported remote address" IP which has the First 3 numbers 'xxx' out of the ocktet.

COLLECTED INFORMATION
Reported remote address
xxx.194.110.199
Browser
Opera v 5.02
OS
Windows 98
Referer
http://boergoat.une.edu.au/meatmrk2.htm
Proxy used
yes
Proxy servers passed
2 ( Type I - 1 )
Nearest proxy
open.proxysniffer.org
Client's address we got
12.148.163.25
Client's hostname
cust.sat.tv.ontario-ca.net
Preferable mail server
harbortelco.com

"OR One (TYPE2) Proxy",

COLLECTED INFORMATION
Reported remote address
xxx.68.114.2
Browser
Netscape v 4.7
OS
Windows 95
Referer
http://basicsecuritybyspa...m
Proxy used
yes
Proxy servers passed
1 ( Type II - 1 )
Nearest proxy
PORTAIL
Client's address we got
195.68.114.2
Client's hostname
mail.francemp3.com
Preferable mail server
mail.francemp3.com

Now if You want to Run both Filters and make it appear that You are running through more than one server, here is want to do. In the Replacement text of the X-Forwarded-For Filter add one or more IP numbers in the string. For example:


KEY="X-Forwarded-For (out):"I.P.-Spoofer"th"
URL="(^asp.flaaten.dk/w|$LST(Exceptions))"
MATCH="$LST(XForward)"
REPLACEMENT="1, 000.00.00.000 , 000.00.00.000"

This arrangement will allow You to Use Both Filters together and Make it Appear that You are running through more than one Server.

COLLECTED INFORMATION
Reported remote address
xxx.80.32.12
Browser
Netscape v 4.06
OS
Windows NT/2000
Referer
http/animaldiversity.ummz...n
Proxy used
yes
Proxy servers passed
4 ( Type I - 3 )
Nearest proxy
martian.alien.xhunter.org
Client's address we got
63.127.192.190
Client's hostname
montreal-est.quebec.ca-cable.net
Preferable mail server
Not found

Have a Great Evening Proxo-Users!
"jak"=:-)




Edited by - JakBeNymble on 26 May 2002  10:09:57
 

JD5000

  • Full Member
  • ***
  • Posts: 241
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://home.satx.rr.com/jd5000/
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #16 on: May 26, 2002, 09:30:35 AM »
Hahaha, I like this. Between these filters, the test sites report 3 dif IP's. LoL


For those who don't want to rename all the IP's in the list for the client Ip filter. Here's mine, I gave up at 40. LoL
(Is it OK for me to post them Jak?)

# List for Client IP Spoofer
#

$CON(1,40)$SET(1=216.41.20.96)
$CON(2,40)$SET(1=12.148.163.136)
$CON(3,40)$SET(1=12.148.163.137)
$CON(4,40)$SET(1=63.127.192.163)
$CON(5,40)$SET(1=12.148.163.138)
$CON(6,40)$SET(1=12.148.163.140)
$CON(7,40)$SET(1=199.105.112.172)
$CON(8,40)$SET(1=12.148.163.28)
$CON(9,40)$SET(1=12.148.163.143)
$CON(10,40)$SET(1=12.148.163.145)
$CON(11,40)$SET(1=199.105.112.184)
$CON(12,40)$SET(1=12.148.163.147)
$CON(13,40)$SET(1=63.127.192.161)
$CON(14,40)$SET(1=63.127.192.161)
$CON(15,40)$SET(1=12.148.163.149)
$CON(16,40)$SET(1=12.148.163.32)
$CON(17,40)$SET(1=12.148.163.151)
$CON(18,40)$SET(1=12.148.163.39)
$CON(19,40)$SET(1=199.105.112.154)
$CON(20,40)$SET(1=63.127.192.162)
$CON(21,40)$SET(1=199.105.112.156)
$CON(22,40)$SET(1=12.148.163.400)
$CON(23,40)$SET(1=63.127.192.138)
$CON(24,40)$SET(1=63.127.192.139)
$CON(25,40)$SET(1=12.148.163.33)
$CON(26,40)$SET(1=12.148.163.41)
$CON(27,40)$SET(1=63.127.192.140)
$CON(28,40)$SET(1=63.127.192.142)
$CON(29,40)$SET(1=12.148.163.42)
$CON(30,40)$SET(1=63.127.192.144)
$CON(31,40)$SET(1=63.127.192.145)
$CON(32,40)$SET(1=12.148.163.25)
$CON(33,40)$SET(1=63.127.192.146)
$CON(34,40)$SET(1=12.148.163.43)
$CON(35,40)$SET(1=63.127.192.147)
$CON(36,40)$SET(1=63.127.192.148)
$CON(37,40)$SET(1=216.41.20.128)
$CON(38,40)$SET(1=12.148.163.35)
$CON(39,40)$SET(1=63.127.192.149)
$CON(40,40)$SET(1=12.148.163.44)

--------

"Imagination is more important than knowledge" - Einstein

Edited by - JD5000 on 26 May 2002  10:35:05

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #17 on: May 26, 2002, 08:24:39 PM »
Hi "JD5000",
           Absolutely, Be My Guest! That's how we learn, by sharing with each other.



Edited by - JakBeNymble on 23 Jun 2002  23:30:22
 

Bes

  • Newbie
  • *
  • Posts: 29
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #18 on: June 03, 2002, 04:20:32 AM »
I just don't get it. You're searching to fake your own IP here, but what's the point ? You can't browse, since the server will reply to the spoofed IP address and not to you.... So, what's the real deal here ?


 
 

sidki3003

  • Sr. Member
  • ****
  • Posts: 476
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #19 on: June 03, 2002, 05:18:46 AM »
Following scenario:
You're connect to the server directly but send a spoofed Via along with a spoofed X-Forwarded-For and/or Client-IP.
The server will still reply to what it believes is a proxy.
But in case of overdone curiousity it will (hopefully) contact the spoofed IP


 
 

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #20 on: June 03, 2002, 05:16:10 PM »
Hi "Bes",
        Welcome to (what I believe to be) the Best FORUM on the 'NET'! Glad You are here!

Thank You for responding. Sidki3003 is correct, the site will forward the page to the Remote Proxy that You are using, and the Proxy will forward the fetched page to Your Real address not the Fake one.  You can even use these filters without a Remote Proxy and the sites will "think" that You are using one anyway. The sites will think that Your assigned IP and Host_Name is the IP and Host_name of a Proxy, and the "Fake Info." being Forwarded is the Real Thing. I have used these filters for good while now, and I haven't experienced any problems browsing. I have direct access dial-up and do not have to use a proxy for my connection. However, there could be unfore-seen differences in ISPs which might cause a problem, and of course if You have a "Nosy ISP" they will be curious since they can see anything and everything going in and out of Your Machine. Mine doesn't seem to mind what I filter and such, just as long as I pay my bill every month and I'm not "Bothering" anyone.

Also the sites will not try to send data to the "Fake Client IP", they will send data to the Proxy requesting the data, whether it is an Actual Remote Proxy or Your machine that "Looks" like a Proxy to it. The Spoofer Filters does NOT HIDE Your IP, they just make Your Machine Look like a Proxy Forwarding some Client's request. And if You are using a Remote Proxy (which will hide Your IP), that Proxy will not try to send data to the "Fake Client IP" either. It will send the requested data to what it  believes to be the "Proxy" that Requested the data(Your Machine), and let that "Proxy" forward the data to the Client. Which of course originated on Your machine to begin with.

Data Flow: (Destination site--->Remote Proxy--->Your Machine which looks like a "Proxy requesting data for a Client")

If You have tried to use the filters and are experiencing problems, please let know what the nature of the problem is. I will be glad to help in any capacity that I can.
And let me take this opportunity again to Welcome You to THE FORUM.
Have a Great & Delightful Day,
'jak'










Edited by - JakBeNymble on 04 Jun 2002  01:06:54
 

Bes

  • Newbie
  • *
  • Posts: 29
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #21 on: June 04, 2002, 03:12:21 AM »
Thanks, Its getting brighter now. But you guys are genius

 
 

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #22 on: June 04, 2002, 04:02:05 AM »
Hi "Bes",
         You are more than Welcome!

You will find that here on THE FORUM we are all just like one big Family. We try to help one another as much as we can. This is a very Friendly FORUM! ARNE doesn't even allow "Bad Language, Impoliteness, or Rudeness", especially to New Members. We are all Friends here, and other than an occasionaly Humourous Cheap Shot at one another Just for FUN, You'll not have to worry about someone trying to make You feel bad for posting or asking a question. There are No Un-Important Questions Here! We all learn from each other. As ARNE says, " The More We Talk, the More We Share, and the More We Share, the More We ALL Are the Better For It"! And I think that "All" of Us Together are a Whole better than any one Of Us Alone. You will find and Make Some of Your Best Friends Right Here On this FORUM. I can speak for My-self, Finding this FORUM, and getting to Know ARNE and the Members Here, is one of the Best things that has ever Happened to me.

Also there is a ton of Very Valuable Very Useful Information that can be found on  The FORUM. Just use the "search" feature at the top of the page just below where You log-in. I use it all the time.

Well I hope that You Have a Wonderful and Blessed Day, My Friend! Keep In Touch!
"jak"

 
 

Arne

  • Administrator
  • Hero Member
  • *****
  • Posts: 778
    • ICQ Messenger - 1448105
    • AOL Instant Messenger - aflaaten
    • Yahoo Instant Messenger - arneflaa
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #23 on: June 06, 2002, 04:54:12 PM »
Hi!!

These filters are really great. I have had a lot of fun with them. It is actually fun to hit reoload at different checkers just to see what comes up next.

I am sitting here with a big smile on my face. They are cool and I have started to use them through my anonymous proxies as well. Great work!!

Best wishes
Arne
Imici username: Arne
Best wishes
Arne
Imici username= Arne

Bes

  • Newbie
  • *
  • Posts: 29
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #24 on: June 18, 2002, 06:56:28 AM »
...so you can spoof your IP with someone else's on a security-scan site, and then see what ports *they* have open ?

 
 

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #25 on: June 18, 2002, 06:11:42 PM »
Hi "FRIENDS",
            THANKX, ARNE I'm glad that You Like them! There is a Special entry in the X-Forwarded-For: List Just For You My GOOD FRIEND!

Hi "Bes", Good to see You on the FORUM. I suppose what really is happening is that the Spoofers Create a "False entity" on Your Machine. A REAL "Ghost in the Machine" if You will. Your machine then just "looks" like a Proxy Server that the "Ghost" is Surfing through. If You don't use an Actual Remote Proxy to surf with, Your Real IP and Host_Name will be logged as the Proxy.

I had a friend over the other day and I think that he discribed it well. He said, "Man, You've taken hacking techniques and turned it into a 'Security' feature"! Security is  what I had in mind when I was putting Spoofers together. Just another Privacy tool for My Proxomitronic-Friends to use to make their Surfing Ground a Safer Place to Play.

I hope that You like them and not having any problems with them. Do You use all three?? The Client-IP filter may seem like "over-kill" but it is for extra Protection. Just in case the Sites are logging more headers than the usual Servers.

Take Care and Keep In Touch.
"Safe-Surfing"
"jak"



Edited by - JakBeNymble on 18 Jun 2002  19:16:40
 

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #26 on: June 19, 2002, 06:26:59 AM »
Hi "My Proxomitronic-Friends",
                              I've finished Up-Loading New Lists on to the Sub-Forum for all three Spoofers. Here are the changes:

(1). The Fake Proxy list(Via) has been given a slower scanning speed now. It changes values every 10 connections instead of the Change every 1 connection. This looks more or less normal to the Sites.[116 entries]

(2). The Fake X-Forwarded-For: List(ISP) has also been given a slower scanning speed. It changes values every 5 connections. Also it has been edited so that Only Fake ISPs are in the list.[84 entries]

(3). The Client-IP list hasn't been changed much, it still has 26 entries in it and it changes values every 1 connection.

Take Care and Safe-surfing My FRIENDS!
"jak"=:-)









Edited by - JakBeNymble on 19 Jun 2002  07:46:39
 

JD5000

  • Full Member
  • ***
  • Posts: 241
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://home.satx.rr.com/jd5000/
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #27 on: June 19, 2002, 06:55:11 AM »
Thanks Jak!

*goes to download*


~JD

--------

"Imagination is more important than knowledge" - Einstein

Bes

  • Newbie
  • *
  • Posts: 29
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #28 on: June 19, 2002, 01:49:21 PM »
Thank you JakBeNymble


Edited by - Bes on 19 Jun 2002  16:33:45
 

JakBeNymble

  • Sr. Member
  • ****
  • Posts: 308
    • ICQ Messenger -
    • AOL Instant Messenger -
    • Yahoo Instant Messenger -
    • View Profile
    • http://
    • Email
Fake Proxy Host_Name & IP Filters!
« Reply #29 on: June 21, 2002, 07:11:05 AM »
Hi "My Proxomitronic-Friends",
                             And "Bes" You and "JD" are more than welcome! I appreciate the support and Your kindness.

I've got a nice U/A that I just put with My configuration to use along with Spoofers. It will make it appear that You are running through One More Proxy, without causing Check sites to log Two different IP.s at the same time. I've slowed down the scanning on the lists so that it would minimumize that problem and every once in awhile http://www8.big.or.jp/%7E000/CyberSyndrome/evc.html
will log two IPs instead of one. But it's still a work in progress.

Here is the U/A:

Mozilla/4.0 (compatible; MSIE 5.0; Win32) via proxy gateway CERN-HTTPD/3.0 libwww/2.17

Also the FORUM didn't mind at all when I logged in!. I have used it in a Non-Rotating U/A Filter and now I have added the last part of the string to the Replacement Text of My Rotating U/A Filter. Using it along with the Spoofing Filters, and it makes it appear that You are running through one more Proxy without causing sites to log 2 or 3 IPs for the same machine.


Here is the "goods" from the leader test-site. I wasn't using a PROXY at all with this checker-page, just the spoofers with the new Lists and the U/A above, and it logged me as Using (3) Proxies! LOL! Remember, Nothing that You see in the COLLECTED INFORMATION is real, except for the IP.


COLLECTED INFORMATION
Reported remote address
XXX.157.151.131
Browser
MSIE v 5.0
OS
Windows 95/98
Referer
http://www.sas.upenn.edu/~nmiller0/dungphoto.html
Proxy used
yes
Proxy servers passed
3 ( Type I - 1 )
Nearest proxy
france.embassycouncil.org
Client's address we got
63.127.192.144
Client's hostname
cust-253-44.oh.cable-link.net
Preferable mail server
lockdowncorp.com

You all Have a Great and Wonderful After-noon, My GOOD FRIENDS!
"Safe-Surfing"
"Jak"

PS: "If You are using a rotating User-Agent Filter/List, You could add the last part of the U/A string to the Replacement text of the "U/A Rotating Filter" and add the "extra Proxy" feature to all Your U/As in the list".=:-)

REPLACEMENT="1 via proxy gateway CERN-HTTPD/3.0 libwww/2.17"
-----------------------------------------------------------------------------------

Here is another U/A I think You might like.

Mozilla/4.78 (TuringOS; Turing Machine; 0.0)

You want to have a good laugh? Use this U/A in Proxo and check it out at http://www.leader.ru/secure/who.html

"More U/As can be found at http://www.psychedelix.com/agents.html"



Edited by - JakBeNymble on 23 Jun 2002  23:20:12